krb5: merged security.c and krb specific FTP functions in here

These two files were always tightly connected and it was hard to
understand what went into which. This also allows us to ma

krb5: merged security.c and krb specific FTP functions in here

These two files were always tightly connected and it was hard to
understand what went into which. This also allows us to make the
ftpsend() function static (moved from ftp.c).

Removed security.c
Renamed curl_sec.h to krb5.h

Closes #5987

show more ...

options: API for meta-data about easy options

const struct curl_easyoption *curl_easy_option_by_name(const char *name);

const struct curl_easyoption *curl_easy_option_by_id (CURLo

options: API for meta-data about easy options

const struct curl_easyoption *curl_easy_option_by_name(const char *name);

const struct curl_easyoption *curl_easy_option_by_id (CURLoption id);

const struct curl_easyoption *
curl_easy_option_next(const struct curl_easyoption *prev);

The purpose is to provide detailed enough information to allow for
example libcurl bindings to get option information at run-time about
what easy options that exist and what arguments they expect.

Assisted-by: Jeroen Ooms
Closes #5365

show more ...

win32: Add Curl_verify_windows_version() to curlx

Closes https://github.com/curl/curl/pull/5754

vtls: Extract and simplify key log file handling from OpenSSL

Create a set of routines for TLS key log file handling to enable reuse
with other TLS backends. Simplify the OpenSSL backend

vtls: Extract and simplify key log file handling from OpenSSL

Create a set of routines for TLS key log file handling to enable reuse
with other TLS backends. Simplify the OpenSSL backend as follows:

- Drop the ENABLE_SSLKEYLOGFILE macro as it is unconditionally enabled.
- Do not perform dynamic memory allocation when preparing a log entry.
Unless the TLS specifications change we can suffice with a reasonable
fixed-size buffer.
- Simplify state tracking when SSL_CTX_set_keylog_callback is
unavailable. My original sslkeylog.c code included this tracking in
order to handle multiple calls to SSL_connect and detect new keys
after renegotiation (via SSL_read/SSL_write). For curl however we can
be sure that a single master secret eventually becomes available
after SSL_connect, so a simple flag is sufficient. An alternative to
the flag is examining SSL_state(), but this seems more complex and is
not pursued. Capturing keys after server renegotiation was already
unsupported in curl and remains unsupported.

Tested with curl built against OpenSSL 0.9.8zh, 1.0.2u, and 1.1.1f
(`SSLKEYLOGFILE=keys.txt curl -vkso /dev/null https://localhost:4433`)
against an OpenSSL 1.1.1f server configured with:

# Force non-TLSv1.3, use TLSv1.0 since 0.9.8 fails with 1.1 or 1.2
openssl s_server -www -tls1
# Likewise, but fail the server handshake.
openssl s_server -www -tls1 -Verify 2
# TLS 1.3 test. No need to test the failing server handshake.
openssl s_server -www -tls1_3

Verify that all secrets (1 for TLS 1.0, 4 for TLS 1.3) are correctly
written using Wireshark. For the first and third case, expect four
matches per connection (decrypted Server Finished, Client Finished, HTTP
Request, HTTP Response). For the second case where the handshake fails,
expect a decrypted Server Finished only.

tshark -i lo -pf tcp -otls.keylog_file:keys.txt -Tfields \
-eframe.number -eframe.time -etcp.stream -e_ws.col.Info \
-dtls.port==4433,http -ohttp.desegment_body:FALSE \
-Y 'tls.handshake.verify_data or http'

A single connection can easily be identified via the `tcp.stream` field.

show more ...

ngtcp2: introduce qlog support

If the QLOGDIR environment variable is set, enable qlogging.

... and create Curl_qlogdir() in the new generic vquic/vquic.c file for
QUIC function

ngtcp2: introduce qlog support

If the QLOGDIR environment variable is set, enable qlogging.

... and create Curl_qlogdir() in the new generic vquic/vquic.c file for
QUIC functions that are backend independent.

Closes #5353

show more ...

dynbuf: introduce internal generic dynamic buffer functions

A common set of functions instead of many separate implementations for
creating buffers that can grow when appending data to t

dynbuf: introduce internal generic dynamic buffer functions

A common set of functions instead of many separate implementations for
creating buffers that can grow when appending data to them. Existing
functionality has been ported over.

In my early basic testing, the total number of allocations seem at
roughly the same amount as before, possibly a few less.

See docs/DYNBUF.md for a description of the API.

Closes #5300

show more ...

mqtt: add new experimental protocol

Closes #5173

rename: a new file for Curl_rename()

And make the cookie save function use it.

polarssl: removed

As detailed in DEPRECATE.md, the polarssl support is now removed after
having been disabled for 6 months and nobody has missed it.

The threadlock files used by

polarssl: removed

As detailed in DEPRECATE.md, the polarssl support is now removed after
having been disabled for 6 months and nobody has missed it.

The threadlock files used by mbedtls are renamed to an 'mbedtls' prefix
instead of the former 'polarssl' and the common functions that
previously were shared between mbedtls and polarssl and contained the
name 'polarssl' have now all been renamed to instead say 'mbedtls'.

Closes #4825

show more ...

wolfSSH: new SSH backend

Adds support for SFTP (not SCP) using WolfSSH.

Closes #4231

TLS: add BearSSL vtls implementation

Closes #4597

lib: Move lib/ssh.h -> lib/vssh/ssh.h

Follow-up to 5b2d703 which moved ssh source files to vssh.

Closes https://github.com/curl/curl/pull/4609

socketpair: an implemention for Windows and more

Curl_socketpair() is designed to be used and work everywhere if there's
no native version or the native version isn't good enough.

socketpair: an implemention for Windows and more

Curl_socketpair() is designed to be used and work everywhere if there's
no native version or the native version isn't good enough.

Closes #4466

show more ...

ngtcp2: Build with latest ngtcp2 and ngtcp2_crypto_openssl

Closes #4270

vssh: create directory for SSH backend code

lib/quic.c: unused - removed

HTTP3: initial (experimental) support

USe configure --with-ngtcp2 or --with-quiche

Using either option will enable a HTTP3 build.
Co-authored-by: Alessandro Ghedini <alessandro@

HTTP3: initial (experimental) support

USe configure --with-ngtcp2 or --with-quiche

Using either option will enable a HTTP3 build.
Co-authored-by: Alessandro Ghedini <alessandro@ghedini.me>

Closes #3500

show more ...

wolfssl: refer to it as wolfSSL only

Remove support for, references to and use of "cyaSSL" from the source
and docs. wolfSSL is the current name and there's no point in keeping
refer

wolfssl: refer to it as wolfSSL only

Remove support for, references to and use of "cyaSSL" from the source
and docs. wolfSSL is the current name and there's no point in keeping
references to ancient history.

Assisted-by: Daniel Gustafsson

Closes #3903

show more ...

altsvc: Fix building with cookies disables

ALTSVC requires Curl_get_line which is defined in lib/cookie.c inside a #if
check of HTTP and COOKIES. That makes Curl_get_line undefined if CO

altsvc: Fix building with cookies disables

ALTSVC requires Curl_get_line which is defined in lib/cookie.c inside a #if
check of HTTP and COOKIES. That makes Curl_get_line undefined if COOKIES is
disabled. Fix by splitting out the function into a separate file which can
be included where needed.

Closes #3717
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>

show more ...

pipelining: removed

As previously planned and documented in DEPRECATE.md, all pipelining
code is removed.

Closes #3651

alt-svc: the libcurl bits

Secure Transport: no more "darwinssl"

Everyone calls it Secure Transport, now we do too.

Reviewed-by: Nick Zitzmann

Closes #3619

axtls: removed

As has been outlined in the DEPRECATE.md document, the axTLS code has
been disabled for 6 months and is hereby removed.

Use a better supported TLS library!

axtls: removed

As has been outlined in the DEPRECATE.md document, the axTLS code has
been disabled for 6 months and is hereby removed.

Use a better supported TLS library!

Assisted-by: Daniel Gustafsson
Closes #3194

show more ...

configure.ac: add a MesaLink vtls backend

URL-API

See header file and man pages for API. All documented API details work
and are tested in the 1560 test case.

Closes #2842